The vub300 driver holds a mutex while sending a USB command and waits for a response. If the command times out, the driver attempts to reset the USB device synchronously, re‑entering the driver and trying to acquire the same mutex again. This results in a recursive lock that deadlocks the task, preventing the driver from releasing the mutex and completing further operations. The device becomes unresponsive, and any processes relying on the driver can be blocked, effectively denying service to that component.

All Linux kernel installations that include the vub300 driver are potentially affected. No specific kernel release or version range is listed, so any kernel that contains the vub300 driver code without the fix is vulnerable.

The CVSS score is 5.5, indicating medium severity. EPSS is <1%, and the vulnerability is not listed in CISA’s KEV catalog, suggesting no known widespread exploitation yet. The likely attack vector is local or remote via USB traffic: an attacker who can influence USB command flow on the host could trigger the timeout condition and induce the deadlock. The impact is a denial of service to the affected USB interface, with a severity that could be considered medium to high depending on the device’s role in the system.